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UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 



ELECTRONIC PRIVACY INFORMATION CENTER 
1718 Connecticut Ave., NW 
Suite 200 

Washington, DC 20009 



Plaintiff, 



v. 



Broadcasting Board of Governors 
330 Independence Avenue, SW 
Washington, DC 20237 



Civil Action No. 



Defendant 



COMPLAINT FOR INJUNCTIVE RELIEF 

1 . This is an action under the Freedom of Information Act ("FOIA"), 5 U.S.C. § 552 
(2012), for injunctive and other appropriate relief, seeking the release of agency records 
requested by the Electronic Privacy Information Center ("EPIC") from the Broadcasting Board 
of Governors ("BBG"). 

2. This lawsuit challenges the failure of BBG to disclose documents in response to 
EPIC's May 31, 2013, Freedom of Information Act request ("EPIC's Request"). EPIC's Request 
sought agency records related to the BBG's relationship with The Tor Project, Inc., the Tor 
Solution Corporation, and the Tor Solutions Group. Defendant has failed to comply with its 
statutory deadline and has failed to disclose a single record. EPIC has filed an administrative 
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appeal and exhausted its administrative remedies. EPIC asks the Court to order immediate 
disclosure of all responsive records. 

Jurisdiction and Venue 

3. This Court has subject matter jurisdiction over this action and personal 
jurisdiction over the parties pursuant to 5 U.S.C. § 552(a)(4)(A)(vii), 5 U.S.C. § 552(a)(4)(B), 
and 5 U.S.C. § 552(a)(6)(C)(i) (2012). This Court also has jurisdiction over this action pursuant 
to 28 U.S.C. § 1331 (2012). Venue is proper in this district under 5 U.S.C. § 552(a)(4)(B) (2012). 

Parties 

4. Plaintiff EPIC is a public interest research organization incorporated as a not-for- 
profit corporation in Washington, D.C. EPIC conducts oversight of government activities and 
policies and analyzes their impact on civil liberties and privacy interests. Among its other 
activities, EPIC publishes books, reports, and a bi-weekly electronic newsletter. EPIC also 
maintains a popular Internet site, http://www.epic.org, which contains extensive information on 
current privacy issues, including documents obtained from federal agencies under the FOIA. 
EPIC routinely and systematically disseminates information to the public through its website and 
other media outlets. This Court recognized EPIC's role as a representative of the news media in 
EPICv. Dep't of Defense, 241 F. Supp. 2d. 5 (D.D.C. 2003). 

5. Defendant BBG is a federal agency within the meaning of 5 U.S.C. § 552(f)(1). 
The BBG oversees all U.S. civilian international media. 

FACTS 

6. Encryption is the core technology for privacy and security. 

7. "Tor" is one of several encryption techniques deployed by Internet users to 
safeguard privacy and security. 

2 



Case l:13-cv-01362-RBW Document 1 Filed 09/09/13 Page 3 of 10 



8. According to Wikipedia, "Tor directs Internet traffic through a free, worldwide 
volunteer network consisting of more than three thousand relays to conceal a user's location or 
usage from anyone conducting network surveillance or traffic analysis." 

9. Tor is currently maintained by the Tor Project, Inc., a 501(c)(3) research- 
education nonprofit organization. 

10. The BBG met with the Tor Project in January 2010 to discuss "various topics." 

11. In June 2012, the Tor Project signed a contract with BBG. 

12. On July 25, 2012, SC Magazine reported that the BBG had provided the Tor 
Project with funding to install 125 "exit nodes" into the network software. 1 

13. The Tor Project reported on August 4, 2013 that a "large number of hidden 
service addresses have disappeared from the Tor Network." 

14. The New York Times, The Guardian, and Pro Publica reported on September 5, 
2013 that the National Security Agency is able to "undermine the major tools protecting the 
privacy of everyday communications in the Internet age, according to newly disclosed 
documents." 

15. A security researcher subsequently determined that Tor communications are 
vulnerable to attack by the National Security Agency. 4 



1 Darren Pauli, "Tor Project mulls $100 cheque for exit relay hosts," SC Magazine (July 25, 2012), available at 
http://www.scmagazinexomMu/News/309813jor-project-mulls-100-cheque-for-exit-relay-hosts.aspx. 

2 "Hidden Services, Current Events, and Freedom Hosting," The Tor Project (Aug. 4, 2013), available at 
https://blog.torproject.org/blog/hidden-services-current-events-and-freedom-hosting. 

3 Nicole Perlroth, Jeff Larson, and Scott Shane, "N.S.A. Able to Foil Basic Safeguards of Privacy on Web," New 
York Times (Sep. 5, 2013) (in print at Al on Sep. 6, 2013), available at http://www.nytimes.com/2013/09/06/us/nsa- 
foils-much-internet-encryption.html; Jeff Larson, "Revealed: The NSA's Secret Campaign to Crack, Undermine 
Internet Encryption," Pro Publica (Sep. 5, 2013), available at http://www.propublica.org/article/the-nsas-secret- 
campaign-to-crack-undermine-internet-encryption; James Ball, Julian Borger, and Glen Greenwald, "Revealed: how 
US and UK spy agencies defeat internet privacy and security," The Guardian (Sep. 5, 2013), available at 
http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security. 

4 Dan Goodin, "Majority of Tor crypto keys could be broken by NSA, researcher says," Ars Technica (Sept. 7, 
2013), available at http://arstechnica.com/security/2013/09/majority-of-tor-crypto-keys-could-be-broken-by-nsa- 
researcher-says. 
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16. As of 2012, the BBG had directed over $1 million dollars to Tor. The Department 
of State, the Department of Defense, and the National Science Foundation have also directed 
federal funds to Tor. In total, the U.S. Government provided 60% of Tor's development costs in 
2012. 5 

17. According to the "Minimization Procedures Used by the National Security 
Agency in Connection with Acquisitions of Foreign Intelligence," 6 a person whose physical 
location is unknown, which will include many users of the Tor service, "will not be treated as a 
United States person, unless such person can be positively identified as such, or the nature or 
circumstances of the person's communications give rise to a reasonable belief that such person is 
a United States person." 7 

18. Also, according to the "Minimization Procedures Used by the National Security 
Agency in Connection with Acquisitions of Foreign Intelligence," in the event that an intercepted 
communication is later deemed to be from a US person, the requirement to promptly destroy the 
material may be suspended in a variety of circumstances, including if the "communications that 
are enciphered or reasonably believed to contain secret meaning, and sufficient duration may 
consist of any period of time during which encrypted material is subject to, or of use in, 

o 

cryptanalysis." 

EPIC's FOIA Request 



5 Brian Fung, "The feds pay for 60 percent of Tor's development. Can users trust it?," The Washington Post (Sep. 6, 
2013), available at http://www.washingtonpost.com^logs/the-switch/wp/2013/09/06/the-feds-pays-for-60-percent- 
of-tors-development-can-users-trust-it. 

6 Glen Greenwald and James Ball, "The top secret rules that allow NSA to use US data without a warrant - Exhibit 
B", The Guardian (June 20, 2013), available at http://www.guardian.co.uk/world/interactive/2013/jun/20/exhibit-b- 
nsa-procedures-document. 

7 Dan Goodin, "Use of Tor and e-mail crypto could increase chances that NSA keeps your data," Ars Technica (June 
20, 2013), available at http://arstechnica.com/tech-policy/2013/06/use-of-tor-and-e-mail-crypto-could-increase- 
chances-that-nsa-keeps-your-data. 

8 W. 
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19. Paragraphs 1-18 above are hereby incorporated by reference as if set forth fully 

herein. 

20. On May 31, 2013, EPIC transmitted, via facsimile, a FOIA request to the BBG's 
FOIA Office, seeking records ("EPIC's FOIA Request"). 

21 . EPIC's FOIA Request asked for the following agency records: 

a. All agreements and contracts concerning BBG funding or sponsorship of The 
Tor Project, Inc., Tor Solution Corporation, and Tor Solutions Group; 

b. Technical specifications of all BBG computers running Tor nodes; 

c. All reports related to BBG's modification of the Tor software; and 

d. All agreements and contracts between the BBG and The Tor Project, Inc., Tor 
Solution Corporation, and Tor Solutions Group regarding features or 
capabilities in the Tor software. 

22. In EPIC's FOIA Request, EPIC also sought "News Media" fee status as a 
"representative of the news media" under 5 U.S.C. § 552(4)(A)(ii). 

23. In EPIC's FOIA Request, EPIC further sought waiver of all duplication fees in 
accordance with 5 U.S.C. § 552(4)(A), because disclosure of the records requested will 
contribute significantly to public understanding of the operations or activities of the government. 
Specifically, EPIC stated that the request concerned both expenditures of the federal government 
and interactions between the development of a crucial piece of software that enables individuals 
to maintain anonymity and circumvent Internet restrictions. 

EPIC's Administrative Appeal 

24. Paragraphs 1-23 above are hereby incorporated by reference as if set forth fully 

herein. 
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25. On July 26, 2013 EPIC filed an administrative appeal with the BBG ("EPIC's 
Administrative Appeal") for a failure to make a timely determination under the FOIA. 

26. At the time of EPIC's Administrative Appeal, 38 working business days had 
elapsed since EPIC's FOIA Request was submitted, without acknowledgement or response from 
the BBG. 

27. In EPIC's Administrative Appeal, EPIC restated its request for "news media" 
status for fee waiver purposes. EPIC also restated its request that any duplication fees should be 
waived because the subject of the request will "contribute significantly to the public understating 
of the operations or activities of the government." 

BBG's Acknowledgement 

28. Paragraphs 1-27 above are hereby incorporated by reference as if set forth fully 

herein. 

29. On July 26, 2013, the BBG acknowledged receipt of EPIC's FOIA Request by 
mail ("BBG Acknowledgement"). EPIC received the letter of acknowledgement on July 29, 
2013. The responding Agency officer was Andrew T. Krog. 

30. In the BBG Acknowledgement, the agency assigned EPIC's Request Reference 
Number 13-0044. 

3 1 . The BBG said it would "require additional time (10 business days) beyond the 20- 
day time limit for processing your request under 'unusual circumstances' defined by statute, 
specifically the need to search for the requested records from office(s) outside of this office." 

32. The BBG placed EPIC's Request in Category II, consisting of educational and 
scientific institutions and news media, meaning that duplication fees would be assessed. 
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33. Finally, the BBG denied EPIC's request for a fee waiver. The BBG 
Acknowledgement stated that "the Agency has determined that your request does not provide 
sufficient information to establish how the records sought would contribute to the general publics 
understanding of the subject matter in question to a significant extent. Furthermore, your request 
does not provide sufficient information as to how the records requested would be disseminated to 
the public at large to facilitate greater understanding of Agency programs or operations." 

BBG's Response to EPIC's Administrative Appeal 

34. Paragraphs 1-33 above are hereby incorporated by reference as if set forth fully 

herein. 

35. On August 2, 2013, the BBG responded to EPIC's Administrative Appeal by mail. 
("BBG Administrative Appeal Response"). EPIC received the BBG's Administrative Appeal 
Response on August 6, 2013. The responding Agency Officer was Andrew T. Krog. 

36. In the BBG Administrative Appeal Response, the agency stated it had "completed 
the search for responsive documents and presented them to Tor for its input regarding trade 
secret or commercial or financial information protectable under Exemption 4 in accordance with 
the Agency's supplemental regulations." 

37. The BBG further stated that the agency had not yet received a response from Tor, 
and therefore was "not able to produce documents at this time." 

38. The BBG further stated that the agency estimated it would be able to complete the 
processing of EPIC's FOIA Request within 15 business days. 

39. The BBG further stated that because "the OPEN Government Act restricts 
agencies from assessing fees when they fail to respond to a request within the required time 
period, the Agency will not assess fees in connection with your request." 
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40. Finally, the BBG asserted that it had "fully satisfied your appeal to the extent 
permitted by the FOIA and Agency Regulations." It also noted that EPIC had the right to appeal 
the determination. 

41 . Through the date of this pleading, the BBG has failed to produce any documents 
in response to EPIC's FOIA request. 

EPIC has Constructively Exhausted its Administrative Remedies 

42. Paragraphs 1-41 above are hereby incorporated by reference as if set forth fully 

herein. 

43. It has been 68 business days since EPIC's FOIA Request was submitted to the 
BBG, and 24 business days since BBG responded to EPIC's FOIA Appeal. 

44. The BBG has failed to respond to EPIC's FOIA Appeal within the twenty-day 
time period prescribed by 5 U.S.C. § 552(a)(6)(A)(ii) (2012). 

45. The BBG's failure to respond within the twenty-day statutory limit constitutes a 
constructive denial of EPIC's request. 

Count I 

Violation of FOIA: Failure to Comply With Statutory Deadlines 

46. Paragraphs 1-45 above are hereby incorporated by reference as if set forth fully 

herein. 

47. As described above, Defendant BBG's failure to respond to EPIC's Request 
violated the statutory deadline imposed by the FOIA set forth in 5 U.S.C. § 552 (a)(6)(A)(ii). 

48. EPIC has exhausted the applicable administrative remedies with respect to EPIC's 
FOIA Request. 5 U.S.C. § 552(a)(4)(B). 
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49. EPIC is entitled to injunctive relief compelling the release and disclosure of the 
requested agency records. 

Count II 

Violation of FOIA: Unlawful Withholding of Agency Records 

50. Paragraphs 1-49 above are hereby incorporated by reference as if set forth fully 

herein. 

51. As described above, the BBG has failed to comply with statutory deadlines and 
failed to make responsive records available to EPIC. 

52. As a result of the BBG's unlawful delay, the agency has withheld responsive 
agency records from EPIC in violation of FOIA, 5 U.S.C. § 552(a)(3)(A). 

53. EPIC has exhausted the applicable administrative remedies with respect to EPIC's 
FOIA Request. 5 U.S.C. § 552(a)(4)(B). 

54. EPIC is entitled to injunctive relief compelling the release and disclosure of the 
requested agency records. 

Requested Relief 

WHEREFORE, Plaintiff prays that this Court: 

A. order Defendant to promptly disclose to Plaintiff responsive agency records; 

B. order Defendant to file, within 14 days of the date of the Court's Order in this 
matter, a Vaughn index, i.e. an affidavit: 1) identifying each document withheld 
from disclosure; 2) stating defendant's claimed statutory exemption as to each 



Case l:13-cv-01362-RBW Document 1 Filed 09/09/13 Page 10 of 10 



withheld document (or portion of a document); and 3) explaining why each 

withheld document is exempt from disclosure; 
C. award Plaintiff its costs and reasonable attorneys' fees incurred in this action 

pursuant to 5 U.S.C. § 552(a)(4)(E) (2010); and 
E. grant such other relief as the Court may deem just and proper. 



Respectfully submitted, 



By: /s/ 

Marc Rotenberg, 
Julia Horwitz, Esquire 

ELECTRONIC PRIVACY INFORMATION 
CENTER 

1718 Connecticut Avenue, N.W. 
Suite 200 

Washington, D.C. 20009 
(202) 483-1140 (telephone) 
(202) 483-1248 (facsimile) 

Dated: September 9, 2013 



Julia Horwitz is barred in Maryland. 
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